Schools and school districts in the US are under continuous threat from cyber attacks, including scams, data breaches, phishing and ransomware attacks. All this can lead to the exposure of sensitive and valuable personally identifiable information (PII) of students, teachers and staff members. Ransomware attacks and even the recovery process itself can be prohibitively expensive for schools with already-constrained budgets.

Research shows that districts can lose between $50,000 and $1 million per single attack. These attacks are more common than you may think. According to the K-12 Cyber Incident Map, a visual representation of the cyber incidents affecting the US K-12 public education sector, clearly shows that more than one incident or attempts are carried out per school day across the entire US. Some reports state that 80% of IT professionals in schools have seen attacks carried out in the last twelve months as cyber criminals continue to view them as soft targets with limited expertise and low cybersecurity budgets. 

These assumptions aren’t entirely wrong. Schools typically spend less than 8% of their overall IT budget on cybersecurity, compared to businesses/enterprises that spend an average of 40% of their budget on cyber security tools and preparedness. 

What Is NIST CSF 2.0?

The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) 2.0 is a voluntary, non-prescriptive cybersecurity framework developed by the National Institute of Standards and Technology (NIST) to help organizations of all sizes and sectors manage and reduce their risks. It provides a structured approach to improve an organization’s overall cybersecurity posture and mitigate the impact of cyberattacks. The framework defines desired cybersecurity outcomes instead of dictating specific controls, allowing organizations to choose the methods that best achieve those outcomes which makes it ideal for schools with limited resources and budgets. 

How Has NIST CSF Changed? And Why?

The NIST Cybersecurity Framework (CSF) was first released in 2014 and underwent its first major update in 2020 with the release of version 2.0. The cyber threat landscape is constantly changing, with new threats, vulnerabilities, and tactics emerging all the time. NIST CSF 2.0 reflects these changes by providing more comprehensive guidance on how to mitigate them.

For example, the framework now places a greater emphasis on supply chain security, reflecting the growing awareness of this critical area.NIST actively solicits feedback from stakeholders, including industry experts, government agencies, and the public, which also contributed to the upgrade. This feedback helps them identify areas for improvement and tailor the framework to better serve its users.

NIST CSF 2.0 also incorporates feedback from a wide range of stakeholders, making it more user-friendly and relevant to the needs of diverse organizations.While the original NIST CSF primarily focused on critical infrastructure, such as power grids and financial institutions. The growing cyber threats faced by organizations of all sizes and sectors prompted NIST to expand the scope of the framework in version 2.0. This ensures that all organizations, regardless of their size or industry, can benefit from the framework’s guidance.

Some of the crucial changes include: 

• Greater focus on governance: Recognizing the crucial role of leadership in managing cybersecurity risks, NIST CSF 2.0 places a stronger emphasis on governance. The new “Govern” function helps organizations establish a comprehensive cybersecurity program that aligns with their overall business goals and risk tolerance. This ensures that cybersecurity is not treated as an isolated issue but is integrated into the broader organizational strategy, and continuously managed.

• Customized pathways: To cater to the diverse needs and experiences of users, NIST CSF 2.0 introduces tailored pathways for specific user groups, including schools. This includes pathways for small businesses, enterprise risk managers, and organizations seeking to secure their supply chains. These pathways provide customized guidance and resources, making it easier for different types of organizations to implement the framework effectively.

• Broader accessibility: Recognizing the global relevance of cybersecurity, NIST has made the framework more accessible by providing translations in multiple languages. This allows organizations worldwide to leverage the framework to bolster their cybersecurity defenses and mitigate risks effectively.

Let’s take a look at how this can help your school. 

The Expanded NIST CSF 2.0 Framework and Your School

NIST CSF 2.0 acknowledges the importance of schools in the broader landscape of cybersecurity. By explicitly including schools within its scope, the framework recognizes the distinct challenges faced by educational institutions and provides them with a roadmap for enhancing their cybersecurity posture. This recognition underscores the critical role that schools play in safeguarding sensitive student data, maintaining operational resilience, and protecting against cyber threats. The expanded framework includes: 

Emphasis on governance

One of the key highlights of NIST CSF 2.0 is its emphasis on governance, which encourages school leadership to prioritize cybersecurity as a strategic necessity. By integrating cybersecurity considerations into the broader governance framework, schools can align their security initiatives with institutional goals and values. Taking this proactive approach fosters a culture of security awareness and accountability throughout the school community, empowering stakeholders to actively participate in the protection of sensitive information and digital assets.

Tailored pathways

The updated framework takes the resource constraints schools and colleges face into account by introducing tailored implementation pathways designed for the education sector (and the challenges they face). These pathways provide practical guidance and best practices for schools with limited resources, offering quick-start guides and specific use cases tailored to their unique needs. The new approach simplifies the entire adoption process and addresses common cybersecurity challenges schools face in a way that empowers schools to take action without overwhelming their IT staff or infrastructure. 

Comprehensive guidance

The inclusion of the “Govern” function in NIST CSF 2.0 represents a more holistic approach to cybersecurity risk management. It covers the entire lifecycle of cybersecurity, from policy development and implementation to ongoing monitoring and improvement. Through adopting a proactive and systematic approach to cybersecurity governance, schools can identify and mitigate risks more effectively, ensuring the resilience and integrity of their digital networks. 

User-friendly resources

NIST CSF 2.0 provides schools with access to dozens of user-friendly resources, including success stories and practical examples from other educational institutions. These resources offer valuable insights into real-world cybersecurity challenges and solutions that schools can learn from and adapt to their specific needs and circumstances. 

Enhanced accessibility

NIST CSF 2.0 promotes inclusivity by offering the framework in multiple languages, catering to the diverse needs of school communities worldwide. This enhanced accessibility ensures that cybersecurity best practices are accessible to everyone, regardless of their preferred language or cultural background. By removing language barriers and promoting universal understanding, the framework fosters a more inclusive and collaborative approach to cybersecurity within the global education sector. As more schools implement the framework and share with the community, the entire sector will become stronger and more resilient. 

Collaboration and feedback

Participation in the NIST CSF 2.0 community enables schools to collaborate with peers, share insights, and exchange feedback on cybersecurity practices. By actively engaging with the broader community, schools can stay informed about emerging threats, trends, and best practices, enabling them to adapt and evolve their cybersecurity strategies accordingly. Collaboration leads continuous improvement and innovation, which in turn helps make the entire education sector more resilient. 

Getting started

The release of NIST CSF 2.0 represents a significant step forward in enhancing cybersecurity  for schools. By expanding the scope of the framework to explicitly include schools, NIST has demonstrated its commitment to addressing the unique challenges faced by educational institutions in today’s digital age. A renewed emphasis on governance, pathways, comprehensive guidance, user-friendly resources, enhanced accessibility, and collaboration means that schools are better equipped than ever before to tackle a changing and challenging cybersecurity landscape. As schools continue to embrace technology, NIST CSF 2.0 is there to offer empowering guidance and support to educators, administrators and stakeholders that are doing their best to keep schools and students safe. 

Remember, don’t hesitate to ask for professional cybersecurity help if you need it.

*** This is a Security Bloggers Network syndicated blog from Blog – Coro Cybersecurity authored by Kevin Smith. Read the original post at: https://www.coro.net/blog/how-nist-csf-2-0-can-help-schools